Mise en Place, operated by Lueken Good Design LLC ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our recipe management service.

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, password
• Profile Information: Optional profile details and preferences
• Recipe Content: Recipes, meal plans, shopping lists, notes, and photos you create or upload
• Payment Information: Processed securely through Stripe (we do not store credit card details)
• Communications: Messages you send us through the feedback system

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the service
• Device Information: Browser type, operating system, IP address
• Cookies: Session cookies for authentication and functionality
• API Logs: Records of API calls for performance monitoring and cost tracking
• Analytics Data (Optional): If you opt in to analytics, anonymous usage data is collected via Heap Analytics to help us understand user behavior and improve the Service

1.3 Third-Party Authentication

If you sign in with Google OAuth, we receive your name, email address, and profile photo from Google.

1.4 Chrome Extension

Our Chrome extension ("Mise en Place - Advanced Recipe Import") collects and processes the following data:

• Authentication Credentials: Email and password to log into your Mise en Place account
• Authentication Tokens: Stored locally in your browser using Chrome's storage API to keep you logged in
• Website URLs: URLs of pages you choose to import recipes from are sent to our servers for processing

The extension does not track your browsing history. We only access URLs when you explicitly click to import a recipe. Recipe data extracted from URLs is processed by the same third-party services listed in Section 3 and stored in your Mise en Place account.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process your recipes through AI parsing and nutrition analysis
• Enable family sharing and collaboration features
• Process payments and manage subscriptions
• Send important updates about your account or the Service
• Respond to your support requests
• Monitor and analyze usage patterns to improve our Service
• Detect and prevent fraud or abuse
• Comply with legal obligations

2.1 Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract Performance: Account data, recipe content, and service features are necessary to perform our contract with you and provide the Service you've requested
• Consent: Analytics data collection (Heap Analytics) is based on your explicit opt-in consent, which you may withdraw at any time
• Legitimate Interest: Security monitoring, fraud detection, and service improvements are based on our legitimate interest in protecting users and maintaining service quality
• Legal Obligation: Certain data retention and processing is required to comply with tax, accounting, and legal obligations

3. Third-Party Services

We share data with the following third-party services to provide our features:

3.1 AI and Data Processing

• Google Cloud Vision: Images you upload for OCR import are processed by Google to extract text
• Anthropic Claude API: Recipe text is processed to parse ingredients, steps, and detect allergens

3.2 Payment Processing

• Stripe: Processes all payments securely. Your payment information goes directly to Stripe and is not stored on our servers

3.3 Authentication

• Google OAuth: If you choose to sign in with Google, they provide us with your basic profile information

3.4 Analytics

• Heap Analytics: If you opt in, we use Heap to collect anonymous usage data to understand how users interact with our Service and improve the user experience

Each third-party service has its own privacy policy governing their use of your data. We encourage you to review their policies.

Data Processing Agreements: We have established Data Processing Agreements (DPAs) with our key data processors, including Google Cloud, Anthropic, and Stripe, to ensure they handle your data in compliance with applicable privacy laws including GDPR.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• With Your Consent: When you share recipes publicly or with family members
• Service Providers: Third-party services listed above that help us operate the Service
• Legal Requirements: If required by law, court order, or government regulation
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Protection: To protect our rights, property, or safety, or that of our users

5. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS)
• Secure password hashing
• Regular security updates and monitoring
• Access controls and authentication
• Secure database storage

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

5.1 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant supervisory authorities within 72 hours of discovering the breach, as required by GDPR and other applicable laws. The notification will include information about the nature of the breach, the data affected, and steps we are taking to address the issue.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal, regulatory, or security purposes.

7. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your recipes and data
• Opt-Out: Unsubscribe from marketing emails (service emails may still be sent)
• Withdraw Consent: Revoke permissions you've granted

To exercise these rights, please contact us through the feedback system in the application.

8. Cookies and Tracking

We use essential cookies for:

• Authentication and session management
• Security and fraud prevention
• Remembering your preferences

If you opt in to analytics, we also use analytics cookies from Heap to understand how users interact with our Service.

You can control cookies through your browser settings, but disabling essential cookies may affect your ability to use the Service.

9. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. For users in the European Economic Area (EEA), we ensure appropriate safeguards are in place for international data transfers, including:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses with our service providers to ensure adequate protection for your data
• Data Processing Agreements: Our processors are contractually obligated to maintain GDPR-level protection for your data
• EU-US Data Privacy Framework: Where applicable, we rely on adequacy decisions and certified frameworks for data transfers

By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate.

11. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information.

12. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last Updated" date at the top of this policy indicates when it was last revised.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us through the feedback system in the application.